fix(gates): five gates that reported PASS over real defects — 45, 46, 19, 13, 20

[rubenvdlinde]

Five gates that reported PASS over real defects. Every green each of them has produced is worth nothing, so each fix is proven in both directions — FAIL on the shape the repos actually contain, PASS on a clean one — and each carries a regression suite that goes red against the pre-fix runner.

#	Gate	Was blind to	Fleet findings
#287	45 prefers-reduced-motion	every stylesheet — it had never opened a .css file	0 → 37
#322	46 spec-anchor-existence	tests/, never enumerated	679 → 951 (+272)
#308	19 e2e-coverage	Playwright testIgnore	0 (hole real, unexploited)
#321	13 modal-isolation	every multi-line-opened dialog	8 → 92 files (+84)
#294	20 or-objectservice-api	comments — its first live finding was one	2 → 1

---

#287 — gate-45 has never read a stylesheet

_a11y_markup_files enumerates .vue/.php/.html and scans <style> blocks. In a Nextcloud app the app-wide motion lives in css/, because that is what Util::addStyle() loads; a <style scoped> block only ever styles one component.

Reproduced: css/main.css with animation: + transition: and no guard → [gate-45] prefers-reduced-motion: PASS. Real instances: nldesign 3 stylesheets, 0 guards; openregister css/main.css, 7 motion declarations, 0 guards.

The un-blinding needed four false-positive controls, because widening a gate fleet-wide is exactly what turns it into a noise generator:

• the guard regex demanded @media followed immediately by (, so @media screen and (prefers-reduced-motion: reduce) — valid and common — would have become a finding
• comments masked; // only in SCSS dialects and never the // of url(https://…)
• transition: none is how a fallback is written, not motion
• a repo-wide universal reset in one file guards every other file — otherwise the gate reports every other stylesheet the day the correct fix lands. Measured: no fleet repo has one today, so this suppresses nothing now; it exists so that fixing these 37 actually turns the gate green
• generated output skipped by content (a >500-char line), which catches webpack's css/main-<hash>.chunk.css that has no .min in its name — 6 findings in app-versions/openwoo dropped

37 findings over 40 repos; 14 in the GitHub fleet (nextcloud-vue 8, nldesign 3, opencatalogi 1, openconnector 1, openregister 1). Existing markup arm unchanged at 143 — nothing widened by accident.

#322 — gate-46, with a correction to the issue's premise

The filed premise does not hold on this package, and I've posted the measurement on the issue so it is corrected where it was read. Planted tags prove tasks.md targets are existence-checked; doriath's 353 all resolve through build_archive_index, which exists precisely for the archived-under-a-date-prefix case, and the archived file exists at the very commit the issue measured. What produced PASS there was ADR-020 diff scoping.

The real hole the investigation found: the enumerator is find lib src. It has never opened a test file. 272 unresolved targets under tests/, in 16 repos. The textbook case is procest — DsoDeadlineJobTest.php annotates tasks.md#T14 against a file numbering T01–T08 and V01–V10.

Landed as a hard FAIL, not a WARN. Diff-scoped under ADR-020, so debt in an untouched test file never blocks a PR; the finding surfaces on the PR that edits it, which is when the tag should be re-checked. A WARN would reproduce the failure mode this band exists to remove.

openspec/ deliberately not added — measured at 292 findings, dominated by documentation templates quoting the syntax (openspec/changes/{name}/tasks.md#task-N).

#308 — gate-19 cannot see testIgnore

Every *.spec.ts under tests/e2e/** counted as a running test. Playwright disagrees. Proven by planting an anchor in a CI-ignored directory: 271 → 270 with the scenario reported COVERED.

A glob list would have been the bug. **/visual/** and **/docs-screenshots.spec.ts sit in a testIgnore in fourteen fleet configs and are pulled back in by the visual / docs-capture projects via testMatch. Treating "named in some testIgnore" as dead would have stripped coverage credit from every visual and docs spec in the fleet. A file is dead only when no project would run it.

Validated against all 21 real fleet configs: every one parses; the only dead files anywhere are the api-direct trees excluded on purpose (openregister 25, openconnector 6). Visual and docs specs: 0 dead.

Fleet finding count: zero. Those api-direct files carry only prose mentions of @e2e plus one whole-spec tag with no slug. The hole is real and proven by a plant; nothing is exploiting it today, so this lands with no churn.

Conservative by construction — no config, an unparsable config, an extglob/brace pattern, a non-literal testMatch/testDir all resolve to LIVE, i.e. to the pre-existing behaviour. Comments masked first: every fleet config explains the replace-not-merge rule in prose containing testIgnore:.

#321 — gate-13 misses every multi-line-opened dialog

grep -qE '<NcModal[ \t>/]|<NcDialog[ \t>/]' matches line by line, so

<NcDialog
    :open="showConfirm"
    name="Delete lead">

has nothing after <NcDialog on its own line and the character class cannot match end-of-line. pipelinq: 0 of 9 real violations seen, while the gate passed its own planted true positive the whole time — because a plant is written on one line and a real dialog is not.

The delimiter is widened to include end-of-line, not dropped, so <NcDialogHeader> still does not match. Comment masking also removes a false positive the old pattern had: it reported a <NcModal> inside a /* */ block.

8 → 92 files across 10 repos — nextcloud-vue 50, procest 13, pipelinq 9, doriath 6, docudesk 4, openregister 3, softwarecatalog 3, decidesk 2, app-versions 1, hermiq 1. nextcloud-vue is the shared component library and accounts for over half; its findings are dialog components outside src/dialogs/ rather than modals inlined in a parent. Hard FAIL, unchanged from what gate-13 already is; diff-scoped, so none of it blocks a PR that does not touch the file.

#294 — gate-20 counted a commented-out call

The first thing the repaired gate reported in the fleet was openconnector lib/Service/SearchService.php:189 — // $directory = $this->objectService->findObjects(...). A gate whose first live finding is false is a gate people learn to ignore.

Applies the pass gate-5 got in #196: source_scope.py --mask php, which blanks //, # and /* */ while preserving offsets so the reported line number still addresses the real file. #[ is left alone — it opens a PHP 8 attribute, and the line these calls sit under is #[NoAdminRequired]. The log now shows the original source line, not the blanked mask.

The mask inherits the gate's own rule: if it cannot run, the gate reports wiring, not a pass. Falling back to raw text would restore the false positive; treating empty mask output as clean would make gate-20 green everywhere — the same failure mode in a new costume.

2 → 1 findings. The one kept is shillinq's real findObject() on a container-resolved ObjectService, the true yield #271 identified.

---

Verification

Both-direction proof for every fix, plus a negative control — each new suite run against the pre-fix runner:

Suite	vs pre-fix runner
test_gate_45_stylesheet_scope.sh (8 arms)	3 red, 5 anti-widening green
test_gate_46_tests_scope.sh (6 arms)	5 red, lib/ arm green
test_check_e2e_coverage.py (+11 tests, 105 → 116)	4 red, 7 anti-widening green
test_gate_13_multiline_dialog.sh (7 arms)	3 red, 4 anti-widening green
test_gate_20_comment_masking.sh (8 arms)	2 red, 4 true-positive arms green

Each suite's anti-widening arms stay green in both runs — the suites are not "everything fails".

• Every checker proven to have lived: .err 0 bytes on each measurement, never an exit code read in place of output.
• The three new .sh suites are picked up automatically by tests/run-helper-suites.sh (discovery-based, no workflow edit).
• test_gate_45_to_55_acceptance.sh run with NODE_PATH set — ajv preflight from test(gates): refuse to run the 45–55 suite when ajv is unresolvable (it reported 4 gate-53 defects that do not exist) #292 intact, ALL GREEN.
• test_gate_a11y_markup_scope.sh ALL PASS; test_check_spec_anchors.py 50/50; full run-helper-suites.sh green.
• No new _skip category introduced, so --require-full-coverage is unaffected. gate-13 and gate-20 gain a wiring skip for a crashed checker, replacing a silent pass.
• quality.yml untouched.

Closes #287
Closes #308
Closes #321
Closes #294
Refs #322

🤖 Generated with Claude Code